Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

hashicorp/vault

              main @ ab34fbd
            

Fixes

CVEs

CRITICAL

Peak severity

31.6%

Coverage

Highlights

Auth Bypass: 39 prior fixes. Scrutinize any change in this area.

builtin/logical/pki: most-fixed (8 issues). Treat as high-risk during review.

35 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Vault's core ACL engine has experienced bypasses where trailing-slash queries could skip more-specific deny rules, and where denied parameter wildcards allowed unauthorized write access. Developers must ensure that both trimmed and full paths undergo most-specific deny evaluation, and parameter filters are strictly enforced on all write and delete operations.

Auth Bypass: TLS client certificate authentication and renewal logic have suffered from improper verification constraints. Weaknesses included failing to validate subject key ID against authority key ID, ignored OCSP verification failures, and missing validation of DNS SANs against PermittedDNSDomains, leading to certificate validation bypasses.

Auth Bypass: The identity store backend has suffered from logical bypasses where SCIM-managed resources were modified or deleted by unauthorized clients, and where deleted or reassigned entity-aliases were not removed from MemDB transaction tables, leaving dangling authorization mapping vulnerabilities.